Subject: RE: [Asrg] Re: 2. Uselessness of C/R

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 28 Jan 2004 13:32:12 -0800

> Beside regular C/R without Turing tests, I am not aware of something 
> that can do the same thing without changing something in the 
> underlying 
> email architechture. The whole advantage of C/R is that it does not 
> require anything to be changed, but annoys end-users. If you can list 
> some other alternatives that can verify the return address, 
> that would be helpful.

S/MIME does not require a change to the email architecture:-)

The issue here is deployment. An individual can deploy C/R without 
any deployment dependencies on any other party.

That is only a show stopper if you are not in a position to influence
the deployment of a new architecture for a substantial fraction
of the Internet.

As people on the list know there is a coalition in existence that
has precisely that capability. One member of that coalition has 
already deployed SPF, another has proposed a cryptographic 
authentication proposal, yet another has made a proposal whose
details are not at present public.

		Phill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 28 Jan 2004 18:41:29 -0500

> the deployment of a new architecture for a substantial fraction

While we are on the topic of S/MIME: currently majority of MUAs have 
S/MIME support built-in including root certificates. Why is that no 
banks or financial companies that are suffering from "phishing" attacks, 
consider signing their email via S/MIME?

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"And this too shall come to pass"
-------